lldb crashes when using tab completion.

[ZequanWu]

lldb version: trunk.

a.cpp

class B {
  int x;
};
class A {
  B t;
  int t2;
};

int main(int argc, char* argv[]) {
  A a;
  return 0;
}

command:
clang++ -g a.cpp && lldb a.out -o "b a.cpp:11" -o "r"

Enter a.t. and use tab completion causes lldb to crash:

(lldb) p a.t.terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string::substr: __pos (which is 4) > this->size() (which is 3)
LLDB diagnostics will be written to /tmp/diagnostics-eaf5b2
Please include the directory content when filing a bug report
[1]    2833408 IOT instruction  lldb a.out -o "b a.cpp:11" -o "r"

[llvmbot]

@llvm/issue-subscribers-lldb

Author: Zequan Wu (ZequanWu)

lldb version: trunk.

a.cpp

class B {
  int x;
};
class A {
  B t;
  int t2;
};

int main(int argc, char* argv[]) {
  A a;
  return 0;
}

command:
clang++ -g a.cpp && lldb a.out -o "b a.cpp:11" -o "r"

Enter a.t. and use tab completion causes lldb to crash:

(lldb) p a.t.terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string::substr: __pos (which is 4) > this->size() (which is 3)
LLDB diagnostics will be written to /tmp/diagnostics-eaf5b2
Please include the directory content when filing a bug report
[1]    2833408 IOT instruction  lldb a.out -o "b a.cpp:11" -o "r"

[Michael137]

Looks like the problem is that we're trying to determine the longest common prefix of the completions to display, but don't account for the possibility of a . (or ->) in the GetCursorArgumentPrefix. Interestingly, we also crash on anything that isn't a letter or number:

v a.t@
v a.t\
etc.

[Michael137]

Actually looks like the list of possible completions we get for v a.t. is:

(lldb_private::StringList) completions = {
  m_strings = size=4 {                    
    [0] = "a.t.x"                         
    [1] = "a.t2"                          
    [2] = "a.t22"                         
    [3] = "a.t3"                          
  }                                       
}                                         

Which doesn't seem right.

[svs-quic]

This is happening since in the checks for completions we check to see if a member name starts with a partial_member_name and in this case both B t and int t2 start with t and we are getting a.t2 as a completion for a.t. which is incorrect. This happens in the function PrivateAutoCompleteMembers in Variable.cpp. The crash goes away if we change the variable t2 to something like f2.

if (partial_member_name.empty() ||
  llvm::StringRef(member_name).starts_with(partial_member_name)) {
  if (member_name == partial_member_name) {
  PrivateAutoComplete(
      frame, partial_path,
      prefix_path + member_name, // Anything that has been resolved
                                 // already will be in here
      member_compiler_type.GetCanonicalType(), request);
  } else {
  request.AddCompletion((prefix_path + member_name).str());
  }

Changing this to the block below seems to work and not crash.

if (partial_member_name.empty()) {
  request.AddCompletion((prefix_path + member_name).str());
  } else if (llvm::StringRef(member_name).starts_with(partial_member_name)) {
  if (member_name == partial_member_name) {
    PrivateAutoComplete(
        frame, partial_path,
        prefix_path + member_name, // Anything that has been resolved
                                   // already will be in here
        member_compiler_type.GetCanonicalType(), request);
  } else if (partial_path.empty()) {
    request.AddCompletion((prefix_path + member_name).str());
  }

I'll still need to figure out how to add a test for this since the existing test TestCompletion.py does not seem to cover this use case.

[Michael137]

This is happening since in the checks for completions we check to see if a member name starts with a partial_member_name and in this case both B t and int t2 start with t and we are getting a.t2 as a completion for a.t. which is incorrect. This happens in the function PrivateAutoCompleteMembers in Variable.cpp. The crash goes away if we change the variable t2 to something like f2.

if (partial_member_name.empty() ||
  llvm::StringRef(member_name).starts_with(partial_member_name)) {
  if (member_name == partial_member_name) {
  PrivateAutoComplete(
      frame, partial_path,
      prefix_path + member_name, // Anything that has been resolved
                                 // already will be in here
      member_compiler_type.GetCanonicalType(), request);
  } else {
  request.AddCompletion((prefix_path + member_name).str());
  }

Changing this to the block below seems to work and not crash.

if (partial_member_name.empty()) {
  request.AddCompletion((prefix_path + member_name).str());
  } else if (llvm::StringRef(member_name).starts_with(partial_member_name)) {
  if (member_name == partial_member_name) {
    PrivateAutoComplete(
        frame, partial_path,
        prefix_path + member_name, // Anything that has been resolved
                                   // already will be in here
        member_compiler_type.GetCanonicalType(), request);
  } else if (partial_path.empty()) {
    request.AddCompletion((prefix_path + member_name).str());
  }

I'll still need to figure out how to add a test for this since the existing test TestCompletion.py does not seem to cover this use case.

Yea that seems about right. We don't want to add completions if there's still user input left to check

[ZequanWu]

Is there an open pr to fix this?

[svs-quic]

I haven't been able to get to this due to other work that I was busy. Shall try to push a patch this week.